Method 2: Using the Net User Command-line Statement

Click Start, and then click Run.

In the Open box, type cmd, and then click OK.

Type net user username /time:logon_times (where username is the name of the user account, and where logon_times are the days and times that you want to allow access to the domain), and then press ENTER.

Use the following information to help you use the /time switch:

Days can be spelled out (for example, Monday) or abbreviated (for example, M,T,W,Th,F,Sa,Su).

Hours can be in 12-hour notation (1PM or 1P.M.) or 24-hour notation (13:00).

A value of blank means that the user can never log on.

A value of all means that a user can always log on.

Use a hyphen (-) to mark a range of days or times. For example, to create a range from Monday through Friday, type either M-F, or monday-friday. To create a range of time from 8:00 P.M. to 5:00 P.M., type 8:00am-5:00pm, 8am-5pm, or 8:00-17:00.

Separate the day and time items with commas (for example, monday,8am-5pm).

Separate day and time units with semicolons (for example, monday,8am-5pm;tuesday,8am-4pm;wednesday,8am-3pm).

Examples

The following examples show how to change the logon times for a specific user account.

To set John's logon time (8:00 A.M. to 5:00 P.M.) using 24-hour notation, type the following command, and then press ENTER:

net user john /time:M-F,08:00-17:00

To set John's logon time (8:00 A.M. to 5:00 P.M.) using 12-hour notation, type the following command, and then press ENTER:

net user john /time:M-F,8am-5pm

To specify logon hours of 4:00 A.M. until 5:00 P.M. on Monday, 1:00 P.M. until 3:00 P.M. on Tuesday, and 8:00 A.M. until 5:00 P.M. Wednesday through Friday for Mary, type the following command, and then press ENTER:

Change Logon Times for a Group of Users

You can use the net user command with the /time switch from the command-line or in a batch file to change logon times for a group of users in a domain. To do this, complete the "Step 1: Create a User Account List" and the "Step 2: Edit Logon Hours by Using the Net User Command" sections of this article.

Step 1: Create a User Account List

Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.

In the console tree, click the organizational unit, or Users folder that contains the user accounts that you want.

On the Action menu, click Export List.

In the Save As dialog box, type the file name that you want in the File name box.

In the Save as type list, click Text (Comma Delimited)(*.csv), and then click Save.

Edit the .csv file by using a text editor such as Notepad to remove entries where you do not want to apply the logon restrictions. The user accounts are listed under a heading with one account on each line. Also, you may have to edit the user names in this file so that they match the user account names that appear when you type Net User at a command prompt.

Type the following command, where file_name is the name of the .csv file that contains the exported user accounts, and where logon_times are the days and times that you want to allow access to the domain:

To allow the users to log on to the server from 8:00 A.M. until 1:00 P.M. on Monday and Friday, and from 8:00 A.M. until 5:00 P.M. on Tuesday through Thursday, type the following command, and then press ENTER:

Enforce Logon Time Restrictions Using Group Policy

Step 1: Create a Group Policy object

To create a Group Policy object (GPO) that you use to enforce client logon restrictions:

Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.

In the console tree, right-click your domain or the organizational unit that contains the domain controllers that you want, and then click Properties.

Click the Group Policy tab, and then click New.

Type a name for this policy (for example, Account logon restrictions), and then press ENTER.

Click Properties, and then click the Security tab.

Click to clear the Apply Group Policy check box for the security groups that you want to prevent from having this policy applied. Click to select the Apply Group Policy check box for the groups that you want to have this policy applied. When you are finished, click OK.

Troubleshoot

Group Policy changes are not immediately enforced. Group Policy background processing can take up to 5 minutes to be refreshed on domain controllers, and up to 120 minutes to be refreshed on client computers. To force background processing of Group Policy settings, use the gpupdate command.

Notesecedit /refreshpolicy has been replaced with gpupdate. For more information about the gpupdate command, see Windows Server 2003 help. To do this, follow these steps: